Re: [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

Casey Schaufler
2008-08-05T03:44:42Z

Cliffe wrote:
> If we had stackable LSMs then the required functionality could simply
> be built into the LSM interface. Then the anti-malware would simply
> stack itself with other LSMs. In my opinion this is a perfect example
> for the argument of stackable LSMs.

No argument from me.

> So far we mainly have LSMs which provide an extra access control
> mechanism (in addition to DAC).

Yes. This is the design center for the LSM.

> IMHO, Ideally DAC could be another stackable LSM (enabled by default).

Yup. Search the archives for "authoritative hooks".

> Other security schemes such as intrusion detection,
> firewalls/netfilter, anti-malware, and application restrictions
> (sandboxes such as jails or finer grained restrictions such as
> AppArmor) could all register LSMs onto the stack.

Stacking is easy for files. It's a real pain in the backside for UDP
packets.

> Additional infrastructure would be necessary. Permissible security
> remains a item of contention. Perhaps I am naive but I think most LSMs
> could work based on accept/reject. Where every LSM must accept an
> action in order for it to be carried out.

Please propose patches.

> MHO,

Oh, humility isn't all it's cracked up to be. Show us all up and
write the code. I'm serious, I don't think there's anyone here who
would object to a really good stacking scheme.